CVE-2026-45013 affects ApostropheCMS (apostrophe) versions <=4.29.0. The vulnerability arises because the password reset URL is built using req.hostname, which is derived from the HTTP Host header. When apos.baseUrl is not explicitly set, this allows an attacker to control the reset link domain by sending a crafted Host header. An attacker who knows a victim's email can trigger a password reset email containing a link to the attacker's domain. Clicking this link delivers the valid reset token to the attacker, enabling account takeover. There is no official patch or fix available at the time of publication.

An unauthenticated attacker can cause password reset emails to contain links pointing to attacker-controlled domains. If victims click these links, attackers receive valid password reset tokens, allowing them to fully compromise user accounts. This results in complete account takeover without requiring authentication or other privileges.

As of the time of this report, no official patch or fix is available. Users should explicitly configure apos.baseUrl to a trusted domain to prevent the application from using the attacker-controlled Host header in reset URLs. Monitor vendor advisories for updates and apply official patches once released.